Pedido online da Pizza Hut Japan · Breach

Pizza Hut Japan confirms leak of up to 4.48 million records

Oct 18, 2026 · 1 min read

Pizza Hut Japan confirmed unauthorized access on October 19, 2026 to the API that exchanges payment information for its online ordering service, with third parties obtaining customer data. Up to about 4.48 million records may have leaked, including customer ID, email, phone number and transaction history; the company says credit card data, names and addresses were not leaked. Cause and scope remain under investigation; the company says it blocked the attack source and customers should monitor for suspicious use of their data.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 3 sources

CriticalBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Pizza Hut Japan confirmed unauthorized access on October 19, 2026 to the system that exchanges payment information for online orders. Third parties obtained customer data in up to about 4.48 million records, such as customer ID, email, phone number and transaction history. According to the company, credit card data, names and addresses were not leaked.

Why it matters

Contact and purchase history data of up to about 4.48 million online ordering customers was exposed, raising the risk of scams by phone, SMS and email. The company says no secondary damage is confirmed so far and that fraudulent orders are not expected. Cause and scope remain under investigation, keeping uncertainty around the case.

What to do

Customers should monitor for suspicious use of their phone number, email and customer ID. Pizza Hut Japan says it blocked the attack source and addressed the vulnerability. Companies running payment APIs between systems should review access controls and monitoring.

For the technical team

Affected: Pedido online da Pizza Hut Japan (API de pagamento) · Pizza Hut Japan online ordering service. Up to about 4.48 million records of online ordering customers, including records of already deleted customer data (Nikkei).
Exploitation: Exploitation confirmed by the company: third-party data acquisition was verified. No CVE, PoC or group attribution in the sources. No secondary damage confirmed so far (Nikkei); the company says it does not expect fraudulent orders (TV Asahi).
Fix: No version or patch applicable. The company says it blocked the attack source, addressed the vulnerability and is reviewing its system management and implementing corrective measures (Nikkei).
Vector: Unauthorized access on October 19, 2026 to the API that exchanges payment information between systems of the Pizza Hut Japan online ordering service. Third parties obtained part of the information from a database holding customer data. The specific cause was not disclosed; the company says it blocked the attack source and addressed the vulnerability.
More details: Data in scope, according to the company and TV Asahi: customer ID, email, phone number and transaction history. Out of scope, according to the company: credit card data, name and address. Nikkei reports the company announcement on October 23. Cause and scope remain under investigation.